Non-invasive encryption for relational database management systems

Abstract

A secure relational database system is provided which utilizes a non-invasive encryption technique. Data pages stored or retrieved by a relational database management system are diverted to a multi-channel hardware encryption engine for processing. Each data page is divided into multiple buffers and distributed among the channels of the hardware encryption engine to be processed simultaneously. The data page is then reassembled and passed on to its intended destination.

1 . A method for encrypting data pages stored by a relational database management system in a data storage system, the method comprising the steps of: 
 dividing a data page designated for storage into a plurality of buffers;    presenting the plurality of buffers to a hardware encryption engine to be encrypted concurrently;    storing the data page in a data storage system after the hardware encryption engine has completed encryption of the plurality of buffers,    wherein the hardware encryption engine reassembles the data page with the plurality of encrypted buffers.    
     
     
         2 . The method according to  claim 1 , wherein the plurality of buffers are sized equally.  
     
     
         3 . The method according to  claim 1 , wherein the hardware encryption engine comprises a plurality of channels and each of the plurality of buffers is presented to a respective one of the plurality of channels.  
     
     
         4 . The method according to  claim 3 , wherein the number of buffers equals the number of channels.  
     
     
         5 . The method according to  claim 1 , wherein the dividing step comprises determining a memory address within the data page for each of the plurality of buffers, and 
 wherein the presenting step comprises presenting a pointer to the memory address of each of the plurality of buffers to the hardware encryption engine.    
     
     
         6 . The method according to  claim 1 , further comprising the step of presenting the plurality of buffers to a hardware compression engine to be compressed concurrently, 
 wherein the data page is stored after the hardware compression engine has completed compression of the plurality of buffers.    
     
     
         7 . A secure relational database system for storing data of a relational database in an encrypted form, the system comprising: 
 a computer server having a processor, a memory and a data storage system;    an operating system, for execution by the processor in the computer server, for managing the processor, the memory and the data storage system of the computer server;    a hardware encryption engine;    a relational database management system, for execution by the processor in the computer server, for managing a relational database stored in the data storage system;    means for diverting a data page written by the relational database management system to the operating system for storage in the data storage system to the hardware encryption engine to be encrypted prior to storing the data page in the data storage system; and    means for diverting a data page read by the relational database management system from the data storage system to the hardware encryption engine to be decrypted prior to the relational database management system receiving the data page.    
     
     
         8 . The secure relational database system according to  claim 7 , further comprising means for dividing the data page written by the relational database management system into a plurality of buffers and presenting the plurality of buffers to the hardware encryption engine to be encrypted concurrently, 
 wherein the hardware encryption engine reassembles the data page with the plurality of encrypted buffers.    
     
     
         9 . The secure relational database system according to  claim 8 , wherein the plurality of buffers are sized equally.  
     
     
         10 . The secure relational database system according to  claim 8 , wherein the hardware encryption engine comprises a plurality of channels and each of the plurality of buffers is presented to a respective one of the plurality of channels.  
     
     
         11 . The secure relational database system according to  claim 10 , wherein the number of buffers equals the number of channels.  
     
     
         12 . The secure relational database system according to  claim 8 , wherein the means for dividing the data page step comprises means for determining a memory address within the data page for each of the plurality of buffers, and 
 wherein the means for presenting the plurality of buffers to the hardware encryption engine presents a pointer to the memory address of each of the plurality of buffers to the hardware encryption engine.    
     
     
         13 . The secure relational database system according to  claim 7 , further comprising: 
 a hardware compression engine;    means for diverting the data page written by the relational database management system to the hardware compression engine to be compressed prior to storing the data page in the data storage system; and    means for diverting the data page read by the relational database management system to the hardware compression engine to be decompressed prior to the relational database management system receiving the data page.    
     
     
         14 . A secure relational database system for storing data of a relational database in an encrypted form, the system comprising: 
 a computer server having a processor, a memory and a data storage system;    an operating system, for execution by the processor in the computer server, for managing the processor, the memory and the data storage system;    a hardware encryption engine;    a relational database management system, for execution by the processor in the computer server, for managing a relational database stored in the data storage system,    wherein, prior to calling a write function of the operating system to store a data page in the data storage system, the relational database management system is configured to divide the data page into a plurality of buffers and present the plurality of buffers to the hardware encryption engine to be encrypted concurrently, wherein the hardware encryption engine reassembles the data page with the plurality of encrypted buffers.    
     
     
         15 . The secure relational database system according to  claim 14 , wherein the plurality of buffers are sized equally.  
     
     
         16 . The secure relational database system according to  claim 14 , wherein the hardware encryption engine comprises a plurality of channels and each of the plurality of buffers is presented to a respective one of the plurality of channels.  
     
     
         17 . The secure relational database system according to  claim 16 , wherein the number of buffers equals the number of channels.  
     
     
         18 . The secure relational database system according to  claim 14 , wherein the relational database management system is configured to determine a memory address within the data page for each of the plurality of buffers, and 
 wherein the relational database management system is configured to present a pointer to the memory address of each of the plurality of buffers to the hardware encryption engine.    
     
     
         19 . The secure relational database system according to  claim 14 , further comprising a hardware compression engine, wherein the relational database management system is configurd to present the plurality of buffers to the hardware compression engine to be compressed concurrently prior to calling the write function of the operating system to store the data page in the data storage system.  
     
     
         20 . Computer-executable program code stored on a computer-readable medium, the computer-executable program code for encrypting data pages stored by a relational database management system in a data storage system, the computer-executable program code comprising: 
 code to divide a data page designated for storage into a plurality of buffers;    code to present the plurality of buffers to a hardware encryption engine to be encrypted concurrently;    code to store the data page in a data storage system after the hardware encryption engine has completed encryption of the plurality of buffers,    wherein the hardware encryption engine reassembles the data page with the plurality of encrypted buffers.    
     
     
         21 . The computer-executable program code according to  claim 20 , wherein the plurality of buffers are sized equally.  
     
     
         22 . The computer-executable program code according to  claim 20 , wherein the hardware encryption engine comprises a plurality of channels and each of the plurality of buffers is presented to a respective one of the plurality of channels.  
     
     
         23 . The computer-executable program code according to  claim 22 , wherein the number of buffers equals the number of channels.  
     
     
         24 . The computer-executable program code according to  claim 20 , wherein the code to divide the data page determines a memory address within the data page for each of the plurality of buffers, and 
 wherein the code to present the plurality of buffers presents a pointer to the memory address of each of the plurality of buffers to the hardware encryption engine.    
     
     
         25 . The computer-executable program code according to  claim 20 , further comprising code to present the plurality of buffers to a hardware compression engine to be compressed concurrently, 
 wherein the data page is stored after the hardware compression engine has completed compression of the plurality of buffers.